Is bcrypt secure in 2026?

Not for new designs. bcrypt is deprecated rather than broken, which means it still resists the attacks it was built for but is no longer the right default. 72-byte input truncation (UX footgun). GPU/FPGA acceleration outruns CPU-based defender.

What is bcrypt used for?

Verifying legacy password databases during migration to Argon2id. New designs where Argon2id isn't available in your runtime.

How should bcrypt output be stored?

bcrypt produces a 184-bit derived key, but you do not store that on its own. The output goes in a modular crypt format string that also carries the salt and the cost parameters, so a future verify knows how the stored value was produced. Never store a bare digest for a password.

Can bcrypt be used to hash passwords?

Yes. bcrypt is a password hashing function, designed to be deliberately slow and tuned through cost parameters so that an attacker who steals the database cannot test candidate passwords cheaply.

Niels Provos, David Mazières, published in 1999.

Hash Lab

deprecatedpassword · 184 bits · 1999

bcrypt

The first really-deliberately-slow password hash. Still everywhere (Rails, Laravel, Django defaults), but Argon2id is the modern pick.

By Deepak Gupta · Last updated May 28, 2026

bcrypt was the first widely deployed password-hashing function explicitly designed to be slow and to scale with hardware via a tunable cost factor. It's still the safe default in many web frameworks because every language has a battle-tested implementation. The two reasons not to pick bcrypt for *new* designs in 2026: it caps input length at 72 bytes (longer passwords are silently truncated, a UX/security footgun), and it has no memory-hardness parameter, so a determined attacker with FPGAs / ASICs can crack it much faster than a defender can hash it. For storing new password hashes today, Argon2id is the better choice; for *verifying* existing bcrypt hashes during a migration, bcrypt is still appropriate.

Recommended uses

·Verifying legacy password databases during migration to Argon2id
·New designs where Argon2id isn't available in your runtime

Known attacks / caveats

·72-byte input truncation (UX footgun)
·GPU/FPGA acceleration outruns CPU-based defender

Designed by

Niels Provos, David Mazières, published 1999.

Try it in the password-hash demo →

Deep dive on guptadeepak.com

The Complete Guide to Password Hashing: Argon2 vs Bcrypt vs Scrypt vs PBKDF2 (2026)

The deep-dive on which password-hashing function to pick and how to tune it.

Frequently asked questions

Is bcrypt secure in 2026?: Not for new designs. bcrypt is deprecated rather than broken, which means it still resists the attacks it was built for but is no longer the right default. 72-byte input truncation (UX footgun). GPU/FPGA acceleration outruns CPU-based defender.
What is bcrypt used for?: Verifying legacy password databases during migration to Argon2id. New designs where Argon2id isn't available in your runtime.
How should bcrypt output be stored?: bcrypt produces a 184-bit derived key, but you do not store that on its own. The output goes in a modular crypt format string that also carries the salt and the cost parameters, so a future verify knows how the stored value was produced. Never store a bare digest for a password.
Can bcrypt be used to hash passwords?: Yes. bcrypt is a password hashing function, designed to be deliberately slow and tuned through cost parameters so that an attacker who steals the database cannot test candidate passwords cheaply.
Who created bcrypt?: Niels Provos, David Mazières, published in 1999.